Another token pool with a 30% sell tax on BNB Chain has been drained. The hacker used a 30 million U flash loan to empty the pool, making off with over 300,000 U.
BlockSec confirmed that the vulnerability lies entirely in the TENDRIL token’s sell-tax logic. The hacker used a flash loan of 30.64 million USDT to manipulate the price. When the sale triggered the 30% tax, the contract called controlburn() and sync(), reducing the pool’s reserves to nearly zero. The hacker then drained the remaining 4.42 million USDT, repaid the loan, and netted $308,960.
Projects often try to prevent sell-offs with hefty taxes, but their code ends up full of holes. When you come across tokens with bizarre tax mechanisms on-chain, not touching them is the best defense.
BlockSec confirmed that the vulnerability lies entirely in the TENDRIL token’s sell-tax logic. The hacker used a flash loan of 30.64 million USDT to manipulate the price. When the sale triggered the 30% tax, the contract called controlburn() and sync(), reducing the pool’s reserves to nearly zero. The hacker then drained the remaining 4.42 million USDT, repaid the loan, and netted $308,960.
Projects often try to prevent sell-offs with hefty taxes, but their code ends up full of holes. When you come across tokens with bizarre tax mechanisms on-chain, not touching them is the best defense.
